FIX: Coverity, out-of-bounds write, CID# 121336, s_index should take factor in consi...

FIX: another thing struck me, the g_index wasn't increased, meaning the "un-decimation" always worked on the same first byte of GraphBuffer.

diff --git a/client/cmddata.c b/client/cmddata.c
index 83d5f3f2acdea8c78450d9dd56caf57dc28c7132..270b00e6ec455fa4abb40054ac017cfdfa54f213 100644 (file)
--- a/client/cmddata.c
+++ b/client/cmddata.c
@@ -827,19 +827,20 @@ int CmdUndec(const char *Cmd)
                return 0;
        }
 
                return 0;
        }
 

-       uint8_t factor = param_get8ex(Cmd, 0,2, 10);
+       uint8_t factor = param_get8ex(Cmd, 0, 2, 10);

        //We have memory, don't we?
        int swap[MAX_GRAPH_TRACE_LEN] = { 0 };
        uint32_t g_index = 0 ,s_index = 0;
        //We have memory, don't we?
        int swap[MAX_GRAPH_TRACE_LEN] = { 0 };
        uint32_t g_index = 0 ,s_index = 0;

-       while(g_index < GraphTraceLen && s_index < MAX_GRAPH_TRACE_LEN)
+       while(g_index < GraphTraceLen && s_index + factor < MAX_GRAPH_TRACE_LEN)

        {
                int count = 0;
        {
                int count = 0;

-               for(count = 0; count < factor && s_index+count < MAX_GRAPH_TRACE_LEN; count ++)
+               for (count = 0; count < factor && s_index + count < MAX_GRAPH_TRACE_LEN; count++)

                        swap[s_index+count] = GraphBuffer[g_index];
                        swap[s_index+count] = GraphBuffer[g_index];

-               s_index+=count;
+               s_index += count;
+               g_index++;

        }
 
        }
 

-       memcpy(GraphBuffer,swap, s_index * sizeof(int));
+       memcpy(GraphBuffer, swap, s_index * sizeof(int));

        GraphTraceLen = s_index;
        RepaintGraphWindow();
        return 0;
        GraphTraceLen = s_index;
        RepaintGraphWindow();
        return 0;